Skip to content
OpenAdvisories
Critical ICSA-26-148-08 3 CVEs

XCharge C6

Published May 28, 2026 · Updated May 28, 2026

Vendor: XCharge Product: C6

Summary

Successful exploitation of these vulnerabilities could allow an attacker to gain administrator rights or execute code on the affected device.

Vulnerabilities 3

  • Critical 9.3
    CVE-2026-9037

    Download of code without integrity check in XCharge C6

    A firmware update mechanism in the affected charging controller fails to validate the authenticity of firmware packages delivered through the device's management interface. Because cryptographic signatures are not verified, an attacker with the ability to int…

    XCharge C6
  • High 8.6
    CVE-2026-9038

    Stack-based buffer overflow in XCharge C6

    A stack-based buffer overflow vulnerability in the charging controller’s signal-processing logic allows an attacker with physical access to the charging interface to supply message fields that exceed expected bounds. Because the input is not sufficiently vali…

    XCharge C6
  • High 8.6
    CVE-2026-9039

    Initialization of a resource with an insecure default in XCharge C6

    A configuration weakness in the device’s remote management service allows an authenticated session to be established over a communication channel intended solely for vehicle-charger signaling. The service is accessible on interfaces exposed through the chargi…

    XCharge C6

Revision history

  1. #1

    Initial Publication

References